17813902210

Committed 17 Sep 2025 11:56PM UTC coverage: 72.24% (-0.04%) from 72.281%

Build # 17813902210

Build Type

push

github

Committed by

web-flow

Commit Message

sysupdate: use conf_files_list_strv_full() where possible (#38198)

Run Details

37 of 44 new or added lines in 1 file covered. (84.09%)

6236 existing lines in 79 files now uncovered.

302695 of 419015 relevant lines covered (72.24%)

1046897.1 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

49.66

/src/shared/mount-setup.c

/* SPDX-License-Identifier: LGPL-2.1-or-later */

#include <sys/mount.h>
#include <unistd.h>

#include "alloc-util.h"
#include "conf-files.h"
#include "dev-setup.h"
#include "efivars.h"
#include "errno-util.h"
#include "fd-util.h"
#include "fileio.h"
#include "label-util.h"
#include "log.h"
#include "mkdir-label.h"
#include "mount-setup.h"
#include "mount-util.h"
#include "mountpoint-util.h"
#include "path-util.h"
#include "recurse-dir.h"
#include "smack-util.h"
#include "string-util.h"
#include "strv.h"
#include "time-util.h"
#include "virt.h"

typedef enum MountMode {
        MNT_NONE              = 0,
        MNT_FATAL             = 1 << 0,
        MNT_IN_CONTAINER      = 1 << 1,
        MNT_CHECK_WRITABLE    = 1 << 2,
        MNT_FOLLOW_SYMLINK    = 1 << 3,
        MNT_USRQUOTA_GRACEFUL = 1 << 4,
} MountMode;

typedef struct MountPoint {
        const char *what;
        const char *where;
        const char *type;
        const char *options;
        unsigned long flags;
        MountMode mode;
        bool (*condition_fn)(void);
} MountPoint;

static bool cgroupfs_recursiveprot_supported(void) {
        int r;

        /* Added in kernel 5.7 */

        r = mount_option_supported("cgroup2", "memory_recursiveprot", /* value = */ NULL);
        if (r < 0)
                log_debug_errno(r, "Failed to determine whether cgroupfs supports 'memory_recursiveprot' mount option, assuming not: %m");
        else if (r == 0)
                log_debug("'memory_recursiveprot' not supported by cgroupfs, not using mount option.");

        return r > 0;
}

int mount_cgroupfs(const char *path) {
        assert(path);

        /* Mount a separate cgroupfs instance, taking all options we initial set into account. This is
         * especially useful when cgroup namespace is *not* employed, since the kernel overrides all
         * previous options if a new mount is established in initial cgns (c.f.
         * https://github.com/torvalds/linux/blob/b69bb476dee99d564d65d418e9a20acca6f32c3f/kernel/cgroup/cgroup.c#L1984)
         *
         * The options shall be kept in sync with those in mount_table below. */

        return mount_nofollow_verbose(LOG_ERR, "cgroup2", path, "cgroup2",
                                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
                                      cgroupfs_recursiveprot_supported() ? "nsdelegate,memory_recursiveprot" : "nsdelegate");
}

static const MountPoint mount_table[] = {
        { "proc",        "/proc",                     "proc",       NULL,                                       MS_NOSUID|MS_NOEXEC|MS_NODEV,
          MNT_FATAL|MNT_IN_CONTAINER|MNT_FOLLOW_SYMLINK },
        { "sysfs",       "/sys",                      "sysfs",      NULL,                                       MS_NOSUID|MS_NOEXEC|MS_NODEV,
          MNT_FATAL|MNT_IN_CONTAINER },
        { "devtmpfs",    "/dev",                      "devtmpfs",   "mode=0755" TMPFS_LIMITS_DEV,               MS_NOSUID|MS_STRICTATIME,
          MNT_FATAL|MNT_IN_CONTAINER },
        { "securityfs",  "/sys/kernel/security",      "securityfs", NULL,                                       MS_NOSUID|MS_NOEXEC|MS_NODEV,
          MNT_NONE                   },
#if ENABLE_SMACK
        { "smackfs",     "/sys/fs/smackfs",           "smackfs",    "smackfsdef=*",                             MS_NOSUID|MS_NOEXEC|MS_NODEV,
          MNT_FATAL, mac_smack_use   },
        { "tmpfs",       "/dev/shm",                  "tmpfs",      "mode=01777,smackfsroot=*",                 MS_NOSUID|MS_NODEV|MS_STRICTATIME,
          MNT_FATAL|MNT_USRQUOTA_GRACEFUL, mac_smack_use },
#endif
        { "tmpfs",       "/dev/shm",                  "tmpfs",      "mode=01777",                               MS_NOSUID|MS_NODEV|MS_STRICTATIME,
          MNT_FATAL|MNT_IN_CONTAINER|MNT_USRQUOTA_GRACEFUL },
        { "devpts",      "/dev/pts",                  "devpts",     "mode=" STRINGIFY(TTY_MODE) ",gid=" STRINGIFY(TTY_GID), MS_NOSUID|MS_NOEXEC,
          MNT_IN_CONTAINER           },
#if ENABLE_SMACK
        { "tmpfs",       "/run",                      "tmpfs",      "mode=0755,smackfsroot=*" TMPFS_LIMITS_RUN, MS_NOSUID|MS_NODEV|MS_STRICTATIME,
          MNT_FATAL, mac_smack_use   },
#endif
        { "tmpfs",       "/run",                      "tmpfs",      "mode=0755" TMPFS_LIMITS_RUN,               MS_NOSUID|MS_NODEV|MS_STRICTATIME,
          MNT_FATAL|MNT_IN_CONTAINER },
        { "cgroup2",     "/sys/fs/cgroup",            "cgroup2",    "nsdelegate,memory_recursiveprot",          MS_NOSUID|MS_NOEXEC|MS_NODEV,
          MNT_FATAL|MNT_IN_CONTAINER|MNT_CHECK_WRITABLE, cgroupfs_recursiveprot_supported },
        { "cgroup2",     "/sys/fs/cgroup",            "cgroup2",    "nsdelegate",                               MS_NOSUID|MS_NOEXEC|MS_NODEV,
          MNT_FATAL|MNT_IN_CONTAINER|MNT_CHECK_WRITABLE },
#if ENABLE_PSTORE
        { "pstore",      "/sys/fs/pstore",            "pstore",     NULL,                                       MS_NOSUID|MS_NOEXEC|MS_NODEV,
          MNT_NONE                   },
#endif
#if ENABLE_EFI
        { "efivarfs",    "/sys/firmware/efi/efivars", "efivarfs",   NULL,                                       MS_NOSUID|MS_NOEXEC|MS_NODEV,
          MNT_NONE, is_efi_boot      },
#endif
        { "bpf",         "/sys/fs/bpf",               "bpf",        "mode=0700",                                MS_NOSUID|MS_NOEXEC|MS_NODEV,
          MNT_NONE                   },
};

/* The first three entries we might need before SELinux is up. The
 * fourth (securityfs) is needed by IMA to load a custom policy. The
 * other ones we can delay until SELinux and IMA are loaded. When
 * SMACK is enabled we need smackfs, too, so it's a fifth one. */
#if ENABLE_SMACK
#define N_EARLY_MOUNT 5
#else
#define N_EARLY_MOUNT 4
#endif

assert_cc(N_EARLY_MOUNT <= ELEMENTSOF(mount_table));

bool mount_point_is_api(const char *path) {
        /* Checks if this mount point is considered "API", and hence
         * should be ignored */

        FOREACH_ELEMENT(i, mount_table)
                if (path_equal(path, i->where))
                        return true;

        return path_startswith(path, "/sys/fs/cgroup/");
}

bool mount_point_ignore(const char *path) {
        /* These are API file systems that might be mounted by other software, we just list them here so that
         * we know that we should ignore them. */
        FOREACH_STRING(i,
                       /* SELinux file systems */
                       "/sys/fs/selinux",
                       /* Container bind mounts */
                       "/dev/console",
                       "/proc/kmsg",
                       "/proc/sys",
                       "/proc/sys/kernel/random/boot_id")
                if (path_equal(path, i))
                        return true;

        if (path_startswith(path, "/run/host")) /* All mounts passed in from the container manager are
                                                 * something we better ignore. */
                return true;

        return false;
}

static int mount_one(const MountPoint *p, bool relabel) {
        int r, priority;

        assert(p);
        assert(p->what);
        assert(p->where);
        assert(p->type);

        priority = FLAGS_SET(p->mode, MNT_FATAL) ? LOG_ERR : LOG_DEBUG;

        if (p->condition_fn && !p->condition_fn())
                return 0;

        /* Relabel first, just in case */
        if (relabel)
                (void) label_fix(p->where, LABEL_IGNORE_ENOENT|LABEL_IGNORE_EROFS);

        r = path_is_mount_point_full(p->where, /* root = */ NULL, AT_SYMLINK_FOLLOW);
        if (r < 0 && r != -ENOENT) {
                log_full_errno(priority, r, "Failed to determine whether %s is a mount point: %m", p->where);
                return FLAGS_SET(p->mode, MNT_FATAL) ? r : 0;
        }
        if (r > 0)
                return 0;

        if (!FLAGS_SET(p->mode, MNT_IN_CONTAINER) && detect_container() > 0)
                return 0;

        /* The access mode here doesn't really matter too much, since
         * the mounted file system will take precedence anyway. */
        if (relabel)
                (void) mkdir_p_label(p->where, 0755);
        else
                (void) mkdir_p(p->where, 0755);

        _cleanup_free_ char *extend_options = NULL;
        const char *o = p->options;
        if (FLAGS_SET(p->mode, MNT_USRQUOTA_GRACEFUL)) {
                r = mount_option_supported(p->type, "usrquota", /* value= */ NULL);
                if (r < 0)
                        log_full_errno(priority, r, "Unable to determine whether %s supports 'usrquota' mount option, assuming not: %m", p->type);
                else if (r == 0)
                        log_debug("Not enabling 'usrquota' on '%s' as kernel lacks support for it.", p->where);
                else {
                        if (!strextend_with_separator(&extend_options, ",", p->options ?: POINTER_MAX, "usrquota"))
                                return log_oom();

                        o = extend_options;
                }
        }

        r = mount_verbose_full(priority, p->what, p->where, p->type, p->flags, o, FLAGS_SET(p->mode, MNT_FOLLOW_SYMLINK));
        if (r < 0)
                return FLAGS_SET(p->mode, MNT_FATAL) ? r : 0;

        /* Relabel again, since we now mounted something fresh here */
        if (relabel)
                (void) label_fix(p->where, 0);

        if (FLAGS_SET(p->mode, MNT_CHECK_WRITABLE))
                if (access(p->where, W_OK) < 0) {
                        r = -errno;

                        (void) umount2(p->where, UMOUNT_NOFOLLOW);
                        (void) rmdir(p->where);

                        log_full_errno(priority, r, "Mount point '%s' not writable after mounting, undoing: %m", p->where);
                        return FLAGS_SET(p->mode, MNT_FATAL) ? r : 0;
                }

        return 1;
}

static int mount_points_setup(size_t n, bool loaded_policy) {
        int r = 0;

        assert(n <= ELEMENTSOF(mount_table));

        FOREACH_ARRAY(mp, mount_table, n)
                RET_GATHER(r, mount_one(mp, loaded_policy));

        return r;
}

int mount_setup_early(void) {
        /* Do a minimal mount of /proc and friends to enable the most basic stuff, such as SELinux */
        return mount_points_setup(N_EARLY_MOUNT, /* loaded_policy= */ false);
}

#if HAVE_SELINUX || ENABLE_SMACK
static int relabel_cb(
                RecurseDirEvent event,
                const char *path,
                int dir_fd,
                int inode_fd,
                const struct dirent *de,
                const struct statx *sx,
                void *userdata) {

        switch (event) {

        case RECURSE_DIR_LEAVE:
        case RECURSE_DIR_SKIP_MOUNT:
                /* If we already saw this dirent when entering it or this is a dirent that on a different
                 * mount, don't relabel it. */
                return RECURSE_DIR_CONTINUE;

        case RECURSE_DIR_ENTER:
                /* /run/initramfs/ + /run/nextroot/ are static data and big, no need to dynamically relabel
                 * its contents at boot... */
                if (PATH_STARTSWITH_SET(path, "/run/initramfs", "/run/nextroot"))
                        return RECURSE_DIR_SKIP_ENTRY;

                _fallthrough_;

        default:
                /* Otherwise, label it, even if we had trouble stat()ing it and similar. SELinux can figure this out */
                (void) label_fix(path, 0);
                return RECURSE_DIR_CONTINUE;
        }
}

static int relabel_tree(const char *path) {
        int r;

        r = recurse_dir_at(AT_FDCWD, path, 0, UINT_MAX, RECURSE_DIR_ENSURE_TYPE|RECURSE_DIR_SAME_MOUNT, relabel_cb, NULL);
        if (r < 0)
                log_debug_errno(r, "Failed to recursively relabel '%s': %m", path);

        return r;
}

static int relabel_extra(void) {
        _cleanup_strv_free_ char **files = NULL;
        int r, c = 0;

        /* Support for relabelling additional files or directories after loading the policy. For this, code in the
         * initrd simply has to drop in *.relabel files into /run/systemd/relabel-extra.d/. We'll read all such files
         * expecting one absolute path by line and will relabel each (and everyone below that in case the path refers
         * to a directory). These drop-in files are supposed to be absolutely minimal, and do not understand comments
         * and such. After the operation succeeded the files are removed, and the drop-in directory as well, if
         * possible.
         */

        r = conf_files_list(&files, ".relabel", NULL,
                            CONF_FILES_FILTER_MASKED | CONF_FILES_REGULAR,
                            "/run/systemd/relabel-extra.d/");
        if (r < 0)
                return log_error_errno(r, "Failed to enumerate /run/systemd/relabel-extra.d/, ignoring: %m");

        STRV_FOREACH(file, files) {
                _cleanup_fclose_ FILE *f = NULL;

                f = fopen(*file, "re");
                if (!f) {
                        log_warning_errno(errno, "Failed to open %s, ignoring: %m", *file);
                        continue;
                }

                for (;;) {
                        _cleanup_free_ char *line = NULL;

                        r = read_line(f, LONG_LINE_MAX, &line);
                        if (r < 0) {
                                log_warning_errno(r, "Failed to read %s, ignoring: %m", *file);
                                break;
                        }
                        if (r == 0) /* EOF */
                                break;

                        path_simplify(line);

                        if (!path_is_normalized(line)) {
                                log_warning("Path to relabel is not normalized, ignoring: %s", line);
                                continue;
                        }

                        if (!path_is_absolute(line)) {
                                log_warning("Path to relabel is not absolute, ignoring: %s", line);
                                continue;
                        }

                        log_debug("Relabelling additional file/directory '%s'.", line);
                        (void) label_fix(line, 0);
                        (void) relabel_tree(line);
                        c++;
                }

                if (unlink(*file) < 0)
                        log_warning_errno(errno, "Failed to remove %s, ignoring: %m", *file);
        }

        /* Remove when we complete things. */
        if (rmdir("/run/systemd/relabel-extra.d") < 0 &&
            errno != ENOENT)
                log_warning_errno(errno, "Failed to remove /run/systemd/relabel-extra.d/ directory: %m");

        return c;
}
#endif

int mount_setup(bool loaded_policy, bool leave_propagation) {
        int r;

        r = mount_points_setup(ELEMENTSOF(mount_table), loaded_policy);
        if (r < 0)
                return r;

#if HAVE_SELINUX || ENABLE_SMACK
        /* Nodes in devtmpfs and /run need to be manually updated for
         * the appropriate labels, after mounting. The other virtual
         * API file systems like /sys and /proc do not need that, they
         * use the same label for all their files. */
        if (loaded_policy) {
                usec_t before_relabel, after_relabel;
                int n_extra;

                before_relabel = now(CLOCK_MONOTONIC);

                FOREACH_STRING(i, "/dev", "/dev/shm", "/run")
                        (void) relabel_tree(i);

                n_extra = relabel_extra();

                after_relabel = now(CLOCK_MONOTONIC);

                log_info("Relabeled /dev/, /dev/shm/, /run/%s in %s.",
                         n_extra > 0 ? ", and additional files" : "",
                         FORMAT_TIMESPAN(after_relabel - before_relabel, 0));
        }
#endif

        /* Create a few default symlinks, which are normally created
         * by udevd, but some scripts might need them before we start
         * udevd. */
        dev_setup(NULL, UID_INVALID, GID_INVALID);

        /* Mark the root directory as shared in regards to mount propagation. The kernel defaults to "private", but we
         * think it makes more sense to have a default of "shared" so that nspawn and the container tools work out of
         * the box. If specific setups need other settings they can reset the propagation mode to private if
         * needed. Note that we set this only when we are invoked directly by the kernel. If we are invoked by a
         * container manager we assume the container manager knows what it is doing (for example, because it set up
         * some directories with different propagation modes). */
        if (detect_container() <= 0 && !leave_propagation)
                if (mount(NULL, "/", NULL, MS_REC|MS_SHARED, NULL) < 0)
                        log_warning_errno(errno, "Failed to set up the root directory for shared mount propagation: %m");

        /* Create a few directories we always want around, Note that sd_booted() checks for /run/systemd/system, so
         * this mkdir really needs to stay for good, otherwise software that copied sd-daemon.c into their sources will
         * misdetect systemd. */
        (void) mkdir_label("/run/systemd", 0755);
        (void) mkdir_label("/run/systemd/system", 0755);

        /* Make sure there's always a place where sandboxed environments can mount root file systems they are
         * about to move into, even when unprivileged, without having to create a temporary one in /tmp/
         * (which they then have to keep track of and clean) */
        (void) mkdir_label("/run/systemd/mount-rootfs", 0555);

        /* Make sure we have a mount point to hide in sandboxes */
        (void) mkdir_label("/run/credentials", 0755);

        /* Also create /run/systemd/inaccessible nodes, so that we always have something to mount
         * inaccessible nodes from. If we run in a container the host might have created these for us already
         * in /run/host/inaccessible/. Use those if we can, since that way we likely get access to block/char
         * device nodes that are inaccessible, and if userns is used to nodes that are on mounts owned by a
         * userns outside the container and thus nicely read-only and not remountable. */
        if (access("/run/host/inaccessible/", F_OK) < 0) {
                if (errno != ENOENT)
                        log_debug_errno(errno, "Failed to check if /run/host/inaccessible exists, ignoring: %m");

                (void) make_inaccessible_nodes("/run/systemd", UID_INVALID, GID_INVALID);
        } else
                (void) symlink("../host/inaccessible", "/run/systemd/inaccessible");

        return 0;
}

1	/* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3	#include <sys/mount.h>
4	#include <unistd.h>
5
6	#include "alloc-util.h"
7	#include "conf-files.h"
8	#include "dev-setup.h"
9	#include "efivars.h"
10	#include "errno-util.h"
11	#include "fd-util.h"
12	#include "fileio.h"
13	#include "label-util.h"
14	#include "log.h"
15	#include "mkdir-label.h"
16	#include "mount-setup.h"
17	#include "mount-util.h"
18	#include "mountpoint-util.h"
19	#include "path-util.h"
20	#include "recurse-dir.h"
21	#include "smack-util.h"
22	#include "string-util.h"
23	#include "strv.h"
24	#include "time-util.h"
25	#include "virt.h"
26
27	typedef enum MountMode {
28	MNT_NONE = 0,
29	MNT_FATAL = 1 << 0,
30	MNT_IN_CONTAINER = 1 << 1,
31	MNT_CHECK_WRITABLE = 1 << 2,
32	MNT_FOLLOW_SYMLINK = 1 << 3,
33	MNT_USRQUOTA_GRACEFUL = 1 << 4,
34	} MountMode;
35
36	typedef struct MountPoint {
37	const char *what;
38	const char *where;
39	const char *type;
40	const char *options;
41	unsigned long flags;
42	MountMode mode;
43	bool (*condition_fn)(void);
44	} MountPoint;
45
46	static bool cgroupfs_recursiveprot_supported(void) {	187✔
47	int r;	187✔
48
49	/* Added in kernel 5.7 */
50
51	r = mount_option_supported("cgroup2", "memory_recursiveprot", /* value = */ NULL);	187✔
52	if (r < 0)	187✔
53	log_debug_errno(r, "Failed to determine whether cgroupfs supports 'memory_recursiveprot' mount option, assuming not: %m");	×
54	else if (r == 0)	187✔
55	log_debug("'memory_recursiveprot' not supported by cgroupfs, not using mount option.");	×
56
57	return r > 0;	187✔
58	}
59
60	int mount_cgroupfs(const char *path) {	136✔
61	assert(path);	136✔
62
63	/* Mount a separate cgroupfs instance, taking all options we initial set into account. This is
64	* especially useful when cgroup namespace is not employed, since the kernel overrides all
65	* previous options if a new mount is established in initial cgns (c.f.
66	* https://github.com/torvalds/linux/blob/b69bb476dee99d564d65d418e9a20acca6f32c3f/kernel/cgroup/cgroup.c#L1984)
67	*
68	* The options shall be kept in sync with those in mount_table below. */
69
70	return mount_nofollow_verbose(LOG_ERR, "cgroup2", path, "cgroup2",	136✔
71	MS_NOSUID\|MS_NOEXEC\|MS_NODEV,
72	cgroupfs_recursiveprot_supported() ? "nsdelegate,memory_recursiveprot" : "nsdelegate");	136✔
73	}
74
75	static const MountPoint mount_table[] = {
76	{ "proc", "/proc", "proc", NULL, MS_NOSUID\|MS_NOEXEC\|MS_NODEV,
77	MNT_FATAL\|MNT_IN_CONTAINER\|MNT_FOLLOW_SYMLINK },
78	{ "sysfs", "/sys", "sysfs", NULL, MS_NOSUID\|MS_NOEXEC\|MS_NODEV,
79	MNT_FATAL\|MNT_IN_CONTAINER },
80	{ "devtmpfs", "/dev", "devtmpfs", "mode=0755" TMPFS_LIMITS_DEV, MS_NOSUID\|MS_STRICTATIME,
81	MNT_FATAL\|MNT_IN_CONTAINER },
82	{ "securityfs", "/sys/kernel/security", "securityfs", NULL, MS_NOSUID\|MS_NOEXEC\|MS_NODEV,
83	MNT_NONE },
84	#if ENABLE_SMACK
85	{ "smackfs", "/sys/fs/smackfs", "smackfs", "smackfsdef=*", MS_NOSUID\|MS_NOEXEC\|MS_NODEV,
86	MNT_FATAL, mac_smack_use },
87	{ "tmpfs", "/dev/shm", "tmpfs", "mode=01777,smackfsroot=*", MS_NOSUID\|MS_NODEV\|MS_STRICTATIME,
88	MNT_FATAL\|MNT_USRQUOTA_GRACEFUL, mac_smack_use },
89	#endif
90	{ "tmpfs", "/dev/shm", "tmpfs", "mode=01777", MS_NOSUID\|MS_NODEV\|MS_STRICTATIME,
91	MNT_FATAL\|MNT_IN_CONTAINER\|MNT_USRQUOTA_GRACEFUL },
92	{ "devpts", "/dev/pts", "devpts", "mode=" STRINGIFY(TTY_MODE) ",gid=" STRINGIFY(TTY_GID), MS_NOSUID\|MS_NOEXEC,
93	MNT_IN_CONTAINER },
94	#if ENABLE_SMACK
95	{ "tmpfs", "/run", "tmpfs", "mode=0755,smackfsroot=*" TMPFS_LIMITS_RUN, MS_NOSUID\|MS_NODEV\|MS_STRICTATIME,
96	MNT_FATAL, mac_smack_use },
97	#endif
98	{ "tmpfs", "/run", "tmpfs", "mode=0755" TMPFS_LIMITS_RUN, MS_NOSUID\|MS_NODEV\|MS_STRICTATIME,
99	MNT_FATAL\|MNT_IN_CONTAINER },
100	{ "cgroup2", "/sys/fs/cgroup", "cgroup2", "nsdelegate,memory_recursiveprot", MS_NOSUID\|MS_NOEXEC\|MS_NODEV,
101	MNT_FATAL\|MNT_IN_CONTAINER\|MNT_CHECK_WRITABLE, cgroupfs_recursiveprot_supported },
102	{ "cgroup2", "/sys/fs/cgroup", "cgroup2", "nsdelegate", MS_NOSUID\|MS_NOEXEC\|MS_NODEV,
103	MNT_FATAL\|MNT_IN_CONTAINER\|MNT_CHECK_WRITABLE },
104	#if ENABLE_PSTORE
105	{ "pstore", "/sys/fs/pstore", "pstore", NULL, MS_NOSUID\|MS_NOEXEC\|MS_NODEV,
106	MNT_NONE },
107	#endif
108	#if ENABLE_EFI
109	{ "efivarfs", "/sys/firmware/efi/efivars", "efivarfs", NULL, MS_NOSUID\|MS_NOEXEC\|MS_NODEV,
110	MNT_NONE, is_efi_boot },
111	#endif
112	{ "bpf", "/sys/fs/bpf", "bpf", "mode=0700", MS_NOSUID\|MS_NOEXEC\|MS_NODEV,
113	MNT_NONE },
114	};
115
116	/* The first three entries we might need before SELinux is up. The
117	* fourth (securityfs) is needed by IMA to load a custom policy. The
118	* other ones we can delay until SELinux and IMA are loaded. When
119	* SMACK is enabled we need smackfs, too, so it's a fifth one. */
120	#if ENABLE_SMACK
121	#define N_EARLY_MOUNT 5
122	#else
123	#define N_EARLY_MOUNT 4
124	#endif
125
126	assert_cc(N_EARLY_MOUNT <= ELEMENTSOF(mount_table));
127
128	bool mount_point_is_api(const char *path) {	140,503✔
129	/* Checks if this mount point is considered "API", and hence
130	* should be ignored */
131
132	FOREACH_ELEMENT(i, mount_table)	1,899,552✔
133	if (path_equal(path, i->where))	1,797,619✔
134	return true;
135
136	return path_startswith(path, "/sys/fs/cgroup/");	101,933✔
137	}
138
139	bool mount_point_ignore(const char *path) {	101,921✔
140	/* These are API file systems that might be mounted by other software, we just list them here so that
141	* we know that we should ignore them. */
142	FOREACH_STRING(i,	602,755✔
143	/* SELinux file systems */
144	"/sys/fs/selinux",
145	/* Container bind mounts */
146	"/dev/console",
147	"/proc/kmsg",
148	"/proc/sys",
149	"/proc/sys/kernel/random/boot_id")
150	if (path_equal(path, i))	505,846✔
151	return true;	5,012✔
152
153	if (path_startswith(path, "/run/host")) /* All mounts passed in from the container manager are	96,909✔
154	* something we better ignore. */
155	return true;	7,518✔
156
157	return false;
158	}
159
160	static int mount_one(const MountPoint *p, bool relabel) {	850✔
161	int r, priority;	850✔
162
163	assert(p);	850✔
164	assert(p->what);	850✔
165	assert(p->where);	850✔
166	assert(p->type);	850✔
167
168	priority = FLAGS_SET(p->mode, MNT_FATAL) ? LOG_ERR : LOG_DEBUG;	850✔
169
170	if (p->condition_fn && !p->condition_fn())	850✔
171	return 0;	850✔
172
173	/* Relabel first, just in case */
174	if (relabel)	641✔
175	(void) label_fix(p->where, LABEL_IGNORE_ENOENT\|LABEL_IGNORE_EROFS);	×
176
177	r = path_is_mount_point_full(p->where, /* root = */ NULL, AT_SYMLINK_FOLLOW);	641✔
178	if (r < 0 && r != -ENOENT) {	641✔
179	log_full_errno(priority, r, "Failed to determine whether %s is a mount point: %m", p->where);	×
180	return FLAGS_SET(p->mode, MNT_FATAL) ? r : 0;	×
181	}
182	if (r > 0)	641✔
183	return 0;
184
185	if (!FLAGS_SET(p->mode, MNT_IN_CONTAINER) && detect_container() > 0)	233✔
186	return 0;
187
188	/* The access mode here doesn't really matter too much, since
189	* the mounted file system will take precedence anyway. */
190	if (relabel)	146✔
191	(void) mkdir_p_label(p->where, 0755);	×
192	else
193	(void) mkdir_p(p->where, 0755);	146✔
194
195	_cleanup_free_ char *extend_options = NULL;	146✔
196	const char *o = p->options;	146✔
197	if (FLAGS_SET(p->mode, MNT_USRQUOTA_GRACEFUL)) {	146✔
198	r = mount_option_supported(p->type, "usrquota", /* value= */ NULL);	14✔
199	if (r < 0)	14✔
200	log_full_errno(priority, r, "Unable to determine whether %s supports 'usrquota' mount option, assuming not: %m", p->type);	×
201	else if (r == 0)	14✔
202	log_debug("Not enabling 'usrquota' on '%s' as kernel lacks support for it.", p->where);	×
203	else {
204	if (!strextend_with_separator(&extend_options, ",", p->options ?: POINTER_MAX, "usrquota"))	28✔
205	return log_oom();	×
206
207	o = extend_options;	14✔
208	}
209	}
210
211	r = mount_verbose_full(priority, p->what, p->where, p->type, p->flags, o, FLAGS_SET(p->mode, MNT_FOLLOW_SYMLINK));	146✔
212	if (r < 0)	146✔
UNCOV 213	return FLAGS_SET(p->mode, MNT_FATAL) ? r : 0;	×
214
215	/* Relabel again, since we now mounted something fresh here */
216	if (relabel)	146✔
UNCOV 217	(void) label_fix(p->where, 0);	×
218
219	if (FLAGS_SET(p->mode, MNT_CHECK_WRITABLE))	146✔
220	if (access(p->where, W_OK) < 0) {	14✔
UNCOV 221	r = -errno;	×
222
223	(void) umount2(p->where, UMOUNT_NOFOLLOW);	×
UNCOV 224	(void) rmdir(p->where);	×
225
UNCOV 226	log_full_errno(priority, r, "Mount point '%s' not writable after mounting, undoing: %m", p->where);	×
227	return FLAGS_SET(p->mode, MNT_FATAL) ? r : 0;	×
228	}
229
230	return 1;
231	}
232
233	static int mount_points_setup(size_t n, bool loaded_policy) {	68✔
234	int r = 0;	68✔
235
236	assert(n <= ELEMENTSOF(mount_table));	68✔
237
238	FOREACH_ARRAY(mp, mount_table, n)	918✔
239	RET_GATHER(r, mount_one(mp, loaded_policy));	850✔
240
241	return r;	68✔
242	}
243
244	int mount_setup_early(void) {	17✔
245	/* Do a minimal mount of /proc and friends to enable the most basic stuff, such as SELinux */
246	return mount_points_setup(N_EARLY_MOUNT, /* loaded_policy= */ false);	17✔
247	}
248
249	#if HAVE_SELINUX \|\| ENABLE_SMACK
UNCOV 250	static int relabel_cb(	×
251	RecurseDirEvent event,
252	const char *path,
253	int dir_fd,
254	int inode_fd,
255	const struct dirent *de,
256	const struct statx *sx,
257	void *userdata) {
258
UNCOV 259	switch (event) {	×
260
261	case RECURSE_DIR_LEAVE:
262	case RECURSE_DIR_SKIP_MOUNT:
263	/* If we already saw this dirent when entering it or this is a dirent that on a different
264	* mount, don't relabel it. */
265	return RECURSE_DIR_CONTINUE;
266
UNCOV 267	case RECURSE_DIR_ENTER:	×
268	/* /run/initramfs/ + /run/nextroot/ are static data and big, no need to dynamically relabel
269	* its contents at boot... */
UNCOV 270	if (PATH_STARTSWITH_SET(path, "/run/initramfs", "/run/nextroot"))	×
UNCOV 271	return RECURSE_DIR_SKIP_ENTRY;	×
272
273	_fallthrough_;	×
274
275	default:
276	/* Otherwise, label it, even if we had trouble stat()ing it and similar. SELinux can figure this out */
277	(void) label_fix(path, 0);	×
UNCOV 278	return RECURSE_DIR_CONTINUE;	×
279	}
280	}
281
UNCOV 282	static int relabel_tree(const char *path) {	×
283	int r;	×
284
UNCOV 285	r = recurse_dir_at(AT_FDCWD, path, 0, UINT_MAX, RECURSE_DIR_ENSURE_TYPE\|RECURSE_DIR_SAME_MOUNT, relabel_cb, NULL);	×
UNCOV 286	if (r < 0)	×
UNCOV 287	log_debug_errno(r, "Failed to recursively relabel '%s': %m", path);	×
288
289	return r;	×
290	}
291
292	static int relabel_extra(void) {	×
293	_cleanup_strv_free_ char **files = NULL;	×
UNCOV 294	int r, c = 0;	×
295
296	/* Support for relabelling additional files or directories after loading the policy. For this, code in the
297	* initrd simply has to drop in *.relabel files into /run/systemd/relabel-extra.d/. We'll read all such files
298	* expecting one absolute path by line and will relabel each (and everyone below that in case the path refers
299	* to a directory). These drop-in files are supposed to be absolutely minimal, and do not understand comments
300	* and such. After the operation succeeded the files are removed, and the drop-in directory as well, if
301	* possible.
302	*/
303
UNCOV 304	r = conf_files_list(&files, ".relabel", NULL,	×
305	CONF_FILES_FILTER_MASKED \| CONF_FILES_REGULAR,
306	"/run/systemd/relabel-extra.d/");
UNCOV 307	if (r < 0)	×
UNCOV 308	return log_error_errno(r, "Failed to enumerate /run/systemd/relabel-extra.d/, ignoring: %m");	×
309
310	STRV_FOREACH(file, files) {	×
UNCOV 311	_cleanup_fclose_ FILE *f = NULL;	×
312
313	f = fopen(*file, "re");	×
314	if (!f) {	×
UNCOV 315	log_warning_errno(errno, "Failed to open %s, ignoring: %m", *file);	×
316	continue;	×
317	}
318
319	for (;;) {	×
320	_cleanup_free_ char *line = NULL;	×
321
322	r = read_line(f, LONG_LINE_MAX, &line);	×
UNCOV 323	if (r < 0) {	×
UNCOV 324	log_warning_errno(r, "Failed to read %s, ignoring: %m", *file);	×
325	break;
326	}
UNCOV 327	if (r == 0) /* EOF */	×
328	break;
329
330	path_simplify(line);	×
331
UNCOV 332	if (!path_is_normalized(line)) {	×
333	log_warning("Path to relabel is not normalized, ignoring: %s", line);	×
UNCOV 334	continue;	×
335	}
336
UNCOV 337	if (!path_is_absolute(line)) {	×
338	log_warning("Path to relabel is not absolute, ignoring: %s", line);	×
339	continue;	×
340	}
341
UNCOV 342	log_debug("Relabelling additional file/directory '%s'.", line);	×
343	(void) label_fix(line, 0);	×
344	(void) relabel_tree(line);	×
345	c++;	×
346	}
347
348	if (unlink(*file) < 0)	×
349	log_warning_errno(errno, "Failed to remove %s, ignoring: %m", *file);	×
350	}
351
352	/* Remove when we complete things. */
UNCOV 353	if (rmdir("/run/systemd/relabel-extra.d") < 0 &&	×
354	errno != ENOENT)	×
355	log_warning_errno(errno, "Failed to remove /run/systemd/relabel-extra.d/ directory: %m");	×
356
357	return c;
358	}
359	#endif
360
361	int mount_setup(bool loaded_policy, bool leave_propagation) {	51✔
362	int r;	51✔
363
364	r = mount_points_setup(ELEMENTSOF(mount_table), loaded_policy);	51✔
365	if (r < 0)	51✔
366	return r;
367
368	#if HAVE_SELINUX \|\| ENABLE_SMACK
369	/* Nodes in devtmpfs and /run need to be manually updated for
370	* the appropriate labels, after mounting. The other virtual
371	* API file systems like /sys and /proc do not need that, they
372	* use the same label for all their files. */
373	if (loaded_policy) {	51✔
UNCOV 374	usec_t before_relabel, after_relabel;	×
UNCOV 375	int n_extra;	×
376
UNCOV 377	before_relabel = now(CLOCK_MONOTONIC);	×
378
UNCOV 379	FOREACH_STRING(i, "/dev", "/dev/shm", "/run")	×
380	(void) relabel_tree(i);	×
381
UNCOV 382	n_extra = relabel_extra();	×
383
UNCOV 384	after_relabel = now(CLOCK_MONOTONIC);	×
385
386	log_info("Relabeled /dev/, /dev/shm/, /run/%s in %s.",	×
387	n_extra > 0 ? ", and additional files" : "",
388	FORMAT_TIMESPAN(after_relabel - before_relabel, 0));
389	}
390	#endif
391
392	/* Create a few default symlinks, which are normally created
393	* by udevd, but some scripts might need them before we start
394	* udevd. */
395	dev_setup(NULL, UID_INVALID, GID_INVALID);	51✔
396
397	/* Mark the root directory as shared in regards to mount propagation. The kernel defaults to "private", but we
398	* think it makes more sense to have a default of "shared" so that nspawn and the container tools work out of
399	* the box. If specific setups need other settings they can reset the propagation mode to private if
400	* needed. Note that we set this only when we are invoked directly by the kernel. If we are invoked by a
401	* container manager we assume the container manager knows what it is doing (for example, because it set up
402	* some directories with different propagation modes). */
403	if (detect_container() <= 0 && !leave_propagation)	51✔
404	if (mount(NULL, "/", NULL, MS_REC\|MS_SHARED, NULL) < 0)	17✔
UNCOV 405	log_warning_errno(errno, "Failed to set up the root directory for shared mount propagation: %m");	×
406
407	/* Create a few directories we always want around, Note that sd_booted() checks for /run/systemd/system, so
408	* this mkdir really needs to stay for good, otherwise software that copied sd-daemon.c into their sources will
409	* misdetect systemd. */
410	(void) mkdir_label("/run/systemd", 0755);	51✔
411	(void) mkdir_label("/run/systemd/system", 0755);	51✔
412
413	/* Make sure there's always a place where sandboxed environments can mount root file systems they are
414	* about to move into, even when unprivileged, without having to create a temporary one in /tmp/
415	* (which they then have to keep track of and clean) */
416	(void) mkdir_label("/run/systemd/mount-rootfs", 0555);	51✔
417
418	/* Make sure we have a mount point to hide in sandboxes */
419	(void) mkdir_label("/run/credentials", 0755);	51✔
420
421	/* Also create /run/systemd/inaccessible nodes, so that we always have something to mount
422	* inaccessible nodes from. If we run in a container the host might have created these for us already
423	* in /run/host/inaccessible/. Use those if we can, since that way we likely get access to block/char
424	* device nodes that are inaccessible, and if userns is used to nodes that are on mounts owned by a
425	* userns outside the container and thus nicely read-only and not remountable. */
426	if (access("/run/host/inaccessible/", F_OK) < 0) {	51✔
427	if (errno != ENOENT)	22✔
UNCOV 428	log_debug_errno(errno, "Failed to check if /run/host/inaccessible exists, ignoring: %m");	×
429
430	(void) make_inaccessible_nodes("/run/systemd", UID_INVALID, GID_INVALID);	22✔
431	} else
432	(void) symlink("../host/inaccessible", "/run/systemd/inaccessible");	29✔
433
434	return 0;
435	}

systemd / systemd / 17813902210

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous